Hjelp til analyse av logger

[fredes]

Håper noen har lyst til å ta en titt på loggene mine:

 

Combofix:

Klikk for å se/fjerne innholdet nedenfor

ComboFix 08-09-01.05 - fredes 2008-09-03 20:54:04.1 - NTFSx86

Microsoft® Windows Vista™ Ultimate 6.0.6000.0.1252.1.1033.18.866 [GMT 2:00]

Running from: C:\Users\fredes\Desktop\comfiks.exe

* Created a new restore point

.

 

((((((((((((((((((((((((( Files Created from 2008-08-03 to 2008-09-03 )))))))))))))))))))))))))))))))

.

 

2008-09-03 20:27 . 2008-09-03 20:27 <DIR> d-------- C:\Users\fredes\AppData\Roaming\SUPERAntiSpyware.com

2008-09-03 20:27 . 2008-09-03 20:27 <DIR> d-------- C:\Users\All Users\SUPERAntiSpyware.com

2008-09-03 20:27 . 2008-09-03 20:27 <DIR> d-------- C:\ProgramData\SUPERAntiSpyware.com

2008-09-03 20:27 . 2008-09-03 20:27 <DIR> d-------- C:\Program Files\SUPERAntiSpyware

2008-09-03 20:23 . 2008-09-03 20:23 <DIR> d-------- C:\Program Files\CCleaner

2008-09-03 20:10 . 2008-09-03 20:10 250 --a------ C:\Windows\gmer.ini

2008-09-03 20:04 . 2008-09-03 20:04 <DIR> d-------- C:\Program Files\Trend Micro

2008-08-30 05:44 . 2008-08-30 05:44 <DIR> d-------- C:\Program Files\FM Modifier 2.2

2008-08-30 02:17 . 2008-08-30 02:17 <DIR> d-------- C:\Users\All Users\Auslogics

2008-08-30 02:17 . 2008-08-30 02:17 <DIR> d-------- C:\ProgramData\Auslogics

2008-08-27 02:02 . 2008-07-19 07:09 1,811,656 --a------ C:\Windows\System32\wuaueng.dll

2008-08-27 02:02 . 2008-07-19 05:44 1,524,736 --a------ C:\Windows\System32\wucltux.dll

2008-08-27 02:02 . 2008-07-19 07:09 563,912 --a------ C:\Windows\System32\wuapi.dll

2008-08-27 02:02 . 2008-07-18 22:08 163,904 --a------ C:\Windows\System32\wuwebv.dll

2008-08-27 02:02 . 2008-07-19 05:44 83,456 --a------ C:\Windows\System32\wudriver.dll

2008-08-27 02:02 . 2008-07-19 07:10 53,448 --a------ C:\Windows\System32\wuauclt.exe

2008-08-27 02:02 . 2008-07-19 07:10 45,768 --a------ C:\Windows\System32\wups2.dll

2008-08-27 02:02 . 2008-07-19 07:10 36,552 --a------ C:\Windows\System32\wups.dll

2008-08-27 02:02 . 2008-07-18 20:44 31,232 --a------ C:\Windows\System32\wuapp.exe

2008-08-21 02:36 . 2008-08-21 02:36 <DIR> d-------- C:\Program Files\OrCAD_Demo

2008-08-21 02:35 . 1998-10-29 16:45 306,688 --a------ C:\Windows\IsUninst.exe

2008-08-18 13:00 . 2008-08-18 13:00 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf

2008-08-18 12:59 . 2008-08-18 12:59 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdRapi_01_00_00.Wdf

2008-08-18 12:59 . 2008-08-18 12:59 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf

2008-08-13 20:26 . 2008-08-21 04:37 <DIR> d--h----- C:\$AVG8.VAULT$

2008-08-13 19:07 . 2008-09-03 16:15 <DIR> d-------- C:\Windows\System32\drivers\Avg

2008-08-13 19:07 . 2008-08-13 19:07 <DIR> d-------- C:\Users\All Users\avg8

2008-08-13 19:07 . 2008-08-13 19:07 <DIR> d-------- C:\ProgramData\avg8

2008-08-13 19:07 . 2008-08-13 19:07 <DIR> d-------- C:\Program Files\AVG

2008-08-13 19:07 . 2008-08-13 19:07 97,928 --a------ C:\Windows\System32\drivers\avgldx86.sys

2008-08-13 19:07 . 2008-08-13 19:07 69,128 --a------ C:\Windows\System32\drivers\avgwfpx.sys

2008-08-13 19:07 . 2008-08-13 19:07 12,936 --a------ C:\Windows\System32\drivers\avgrkx86.sys

2008-08-13 19:07 . 2008-08-13 19:07 10,520 --a------ C:\Windows\System32\avgrsstx.dll

2008-08-13 15:37 . 2008-08-13 15:37 <DIR> d-------- C:\Program Files\Dell

2008-08-13 15:37 . 2008-08-13 15:37 7,168 --a------ C:\Windows\DellBIOS.Sys

2008-08-13 15:36 . 2008-09-03 16:17 104,185 --a------ C:\Users\All Users\nvModes.dat

2008-08-13 15:36 . 2008-09-03 16:17 104,185 --a------ C:\ProgramData\nvModes.dat

2008-08-13 15:19 . 2007-09-13 14:45 4,947,968 --a------ C:\Windows\System32\stacgui.cpl

2008-08-13 15:19 . 2007-04-10 17:02 1,601,536 --a------ C:\Windows\System32\stlang.dll

2008-08-13 15:19 . 2007-09-13 14:45 102,400 --a------ C:\Windows\System32\stacsv.exe

2008-08-13 15:18 . 2007-09-13 14:45 595,456 --a------ C:\Windows\System32\stapo.dll

2008-08-13 15:18 . 2007-09-13 14:46 330,240 --a------ C:\Windows\System32\drivers\stwrt.sys

2008-08-13 15:18 . 2007-09-13 14:45 328,704 --a------ C:\Windows\System32\stcplx.dll

2008-08-13 15:18 . 2007-09-13 14:44 299,520 --a------ C:\Windows\System32\stapi32.dll

2008-08-13 15:18 . 2007-09-13 14:45 146,944 --a------ C:\Windows\System32\st325614.dll

2008-08-13 14:52 . 2008-07-16 01:48 2,048 --a------ C:\Windows\System32\tzres.dll

2008-08-13 14:47 . 2008-08-13 14:47 <DIR> d-------- C:\Users\fredes\AppData\Roaming\SystemRequirementsLab

2008-08-13 14:45 . 2008-08-13 14:45 <DIR> d-------- C:\Users\All Users\Apple

2008-08-13 14:45 . 2008-08-13 14:45 <DIR> d-------- C:\ProgramData\Apple

2008-08-13 14:45 . 2008-08-13 14:45 <DIR> d-------- C:\Program Files\Apple Software Update

2008-08-13 10:56 . 2008-06-19 05:25 361,984 --a------ C:\Windows\System32\IPSECSVC.DLL

2008-08-13 10:56 . 2008-06-19 05:25 272,896 --a------ C:\Windows\System32\polstore.dll

2008-08-13 10:56 . 2008-06-19 05:25 61,440 --a------ C:\Windows\System32\winipsec.dll

2008-08-13 10:56 . 2008-06-19 05:25 28,672 --a------ C:\Windows\System32\FwRemoteSvr.dll

2008-08-11 19:31 . 2008-08-11 19:31 <DIR> d-------- C:\Users\All Users\Apple Computer

2008-08-11 19:31 . 2008-08-11 19:31 <DIR> d-------- C:\ProgramData\Apple Computer

2008-08-11 19:31 . 2008-08-11 19:32 <DIR> d-------- C:\Program Files\QuickTime

2008-08-08 16:01 . 2008-08-08 16:01 <DIR> d-------- C:\Program Files\File Scavenger 3.2

2008-08-08 03:57 . 2008-08-08 03:57 <DIR> d-------- C:\Program Files\Ultra Video Splitter

2008-08-08 03:57 . 2007-04-12 14:19 129,024 --a------ C:\Windows\System32\AVERM.dll

2008-08-08 03:57 . 2006-09-26 13:57 28,672 --a------ C:\Windows\System32\AVEQT.dll

2008-08-08 03:53 . 2008-08-08 03:53 <DIR> d-------- C:\Program Files\MPEGSPLITTER

2008-08-08 00:45 . 2008-08-08 00:45 <DIR> d-------- C:\Program Files\mkv2vob

2008-08-08 00:45 . 2008-09-03 20:27 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-09-03 17:49 --------- d-----w C:\Users\fredes\AppData\Roaming\Azureus

2008-08-30 00:16 2,020 ----a-w C:\Windows\System32\ealregsnapshot1.reg

2008-08-27 20:06 --------- d-----w C:\Program Files\Java

2008-08-20 16:59 --------- d-----w C:\ProgramData\NVIDIA

2008-08-20 16:46 174 --sha-w C:\Program Files\desktop.ini

2008-08-20 16:33 --------- d-----w C:\Program Files\Windows Sidebar

2008-08-20 16:33 --------- d-----w C:\Program Files\Windows Photo Gallery

2008-08-20 16:33 --------- d-----w C:\Program Files\Windows Mail

2008-08-20 16:33 --------- d-----w C:\Program Files\Windows Journal

2008-08-20 16:33 --------- d-----w C:\Program Files\Windows Defender

2008-08-20 16:33 --------- d-----w C:\Program Files\Windows Collaboration

2008-08-20 16:33 --------- d-----w C:\Program Files\Windows Calendar

2008-08-20 16:20 79,872 ----a-w C:\Windows\System32\axaltocm.dll

2008-08-20 16:20 101,376 ----a-w C:\Windows\System32\ifxcardm.dll

2008-08-18 11:35 --------- d-----w C:\ProgramData\Logitech

2008-08-13 12:54 --------- d-----w C:\ProgramData\Microsoft Help

2008-08-13 12:47 --------- d-----w C:\Program Files\SystemRequirementsLab

2008-08-01 15:30 --------- d-----w C:\Users\fredes\AppData\Roaming\Pro Cycling Manager 2008

2008-07-29 19:43 --------- d-----w C:\Program Files\TVAnts

2008-07-29 18:44 --------- d-----w C:\Program Files\SopCast

2008-07-29 11:47 130,208 ------r C:\Windows\bwUnin-8.1.1.87-8876480SL.exe

2008-07-23 14:40 304,528 ----a-w C:\Windows\System32\appdrvrem01.exe

2008-07-23 14:40 3,468,904 ----a-w C:\Windows\system32\drivers\appdrv01.sys

2008-07-23 12:43 102,337 ----a-w C:\Users\fredes\AppData\Roaming\nvModes.dat

2008-07-23 12:40 --------- d-----w C:\Program Files\Cyanide

2008-07-21 18:58 --------- d-----w C:\Users\fredes\AppData\Roaming\Auslogics

2008-07-21 18:50 --------- d-----w C:\Program Files\Auslogics

2008-07-21 18:44 --------- d-----w C:\Program Files\Microsoft Silverlight

2008-07-08 21:50 0 ---ha-w C:\Windows\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf

2008-06-27 03:54 826,368 ----a-w C:\Windows\System32\wininet.dll

2008-06-27 03:54 56,320 ----a-w C:\Windows\System32\iesetup.dll

2008-06-27 03:54 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll

2008-06-27 03:54 26,624 ----a-w C:\Windows\System32\ieUnatt.exe

2008-06-26 00:34 7,964,672 ----a-w C:\Windows\System32\NlsLexicons0024.dll

2008-06-26 00:33 9,892,864 ----a-w C:\Windows\System32\NlsLexicons000a.dll

2008-06-18 14:33 107,888 ----a-w C:\Windows\System32\CmdLineExt.dll

2008-06-12 06:54 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll

2008-06-12 06:54 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll

2008-06-12 01:21 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll

.

 

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]

"i8kfangui"="C:\Program Files\I8kfanGUI\I8kfanGUI.exe" [2007-02-16 856064]

"VistaBatterySaver"="C:\Program Files\SharpSoft\Vista Battery Saver\VistaBatterySaver.exe" [2007-08-24 479232]

"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]

"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-11-17 171464]

"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 125440]

"Google Update"="C:\Users\fredes\AppData\Local\Google\Update\GoogleUpdate.exe" [2008-09-02 133104]

"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-08-19 1576176]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2007-01-25 159744]

"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-05-08 174872]

"IaNvSrv"="C:\Program Files\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe" [2007-05-08 33048]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]

"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]

"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]

"Windows Mobile-based device management"="C:\Windows\WindowsMobile\wmdSync.exe" [2006-11-02 215552]

"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-08-13 1235736]

"SigmatelSysTrayApp"="C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2007-09-13 405504]

"NvSvc"="C:\Windows\system32\nvsvc.dll" [2008-02-22 166432]

"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2008-02-22 13515296]

"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2008-02-22 92704]

"NVHotkey"="C:\Windows\system32\nvHotkey.dll" [2008-02-22 92704]

"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-06-12 C:\Windows\KHALMNPR.Exe]

 

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\

Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2008-07-29 91440]

Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-11-07 768528]

QuickSet.lnk - C:\Program Files\Dell\QuickSet\quickset.exe [2008-02-22 1193240]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableLUA"= 0 (0x0)

"DisableStartupSound"= 1 (0x1)

 

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2008-07-23 16:28 352256 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=avgrsstx.dll

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"{5307386B-A21A-4DBE-939F-F65A8684FF90}"= C:\Program Files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)

"{B1D3033E-250B-436D-A46C-6B32FA9AFB7D}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook

"{B27ED313-19C7-4459-94FC-D032CA233BE4}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove

"{2159F5F8-17CC-4CF0-BB38-22D8D8CCFF8D}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove

"{2ED20B1F-B76C-45AC-B006-729D8B197DA2}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote

"{7064CFF7-F8D1-45A0-BB2A-9A60DB8D847E}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote

"TCP Query User{8372A183-76D3-468E-8FE6-8D3075AB99A0}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox

"UDP Query User{6F464896-4455-49AD-B98E-E7A9DD75CD0D}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox

"TCP Query User{761F11A7-F606-4FA2-B989-92E920692C7D}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox

"UDP Query User{1B160DAC-4DB1-44A0-8C21-314BA7C5C17F}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox

"TCP Query User{F5AD415F-D03F-43DC-B2D0-BA0C1BB87FAA}C:\\program files\\maple 11\\jre\\bin\\maple.exe"= UDP:C:\program files\maple 11\jre\bin\maple.exe:Maple 11

"UDP Query User{99A38D68-D50F-4C22-8229-E377768CAB02}C:\\program files\\maple 11\\jre\\bin\\maple.exe"= TCP:C:\program files\maple 11\jre\bin\maple.exe:Maple 11

"TCP Query User{324E482C-C3C3-4BCF-A24E-7601854A8908}C:\\program files\\maple 11\\jre\\bin\\maple.exe"= UDP:C:\program files\maple 11\jre\bin\maple.exe:Maple 11

"UDP Query User{546F13CB-F8F9-4C15-BDAA-2FFC859B1111}C:\\program files\\maple 11\\jre\\bin\\maple.exe"= TCP:C:\program files\maple 11\jre\bin\maple.exe:Maple 11

"TCP Query User{A2E4D9C9-DD6F-49B9-895E-E0E5625575AD}C:\\program files\\azureus\\azureus.exe"= UDP:C:\program files\azureus\azureus.exe:Azureus

"UDP Query User{AEB5B9E8-C3E1-438A-835A-470EE7189DE7}C:\\program files\\azureus\\azureus.exe"= TCP:C:\program files\azureus\azureus.exe:Azureus

"TCP Query User{16BFB7CA-3117-4718-88B6-2453C33373CE}C:\\program files\\electronic arts\\eadm\\core.exe"= UDP:C:\program files\electronic arts\eadm\core.exe:EA Download Manager

"UDP Query User{280DB631-2593-40C9-B8C8-274EC8F52382}C:\\program files\\electronic arts\\eadm\\core.exe"= TCP:C:\program files\electronic arts\eadm\core.exe:EA Download Manager

"TCP Query User{69145179-F4CF-4680-8989-A564878AE815}C:\\program files\\electronic arts\\eadm\\core.exe"= UDP:C:\program files\electronic arts\eadm\core.exe:EA Download Manager

"UDP Query User{68E60955-460E-4810-B92B-29EDDB660D8A}C:\\program files\\electronic arts\\eadm\\core.exe"= TCP:C:\program files\electronic arts\eadm\core.exe:EA Download Manager

"{1B959C40-8266-444D-9D56-1609FA8E61C5}"= UDP:C:\Program Files\Sports Interactive\Football Manager 2008\fm.exe:Football Manager 2008

"{4D384DF6-FE84-4443-A5D9-AB340D6E82D8}"= TCP:C:\Program Files\Sports Interactive\Football Manager 2008\fm.exe:Football Manager 2008

"TCP Query User{F41D5C44-737B-4B2F-95CB-41E3AB2A902E}C:\\program files\\azureus\\azureus.exe"= UDP:C:\program files\azureus\azureus.exe:Azureus

"UDP Query User{722D573A-40D3-451F-A328-9A7D4FD26AE5}C:\\program files\\azureus\\azureus.exe"= TCP:C:\program files\azureus\azureus.exe:Azureus

"{BB9D7157-A943-4AA8-9A89-CF81B6B4B8D9}"= UDP:C:\Program Files\Cyanide\GameCenter\GameCenter.exe:GameCenter

"{5633D6D0-C3CB-425B-8875-92FD90946531}"= TCP:C:\Program Files\Cyanide\GameCenter\GameCenter.exe:GameCenter

"{A21DB39B-0084-4D77-AF00-68B9A8DD2616}"= UDP:C:\Program Files\Cyanide\Pro Cycling Manager - Season 2008\PCM.exe:Pro Cycling Manager - Season 2008

"{432A7A94-4567-48D0-8ED7-8E3CC1E059AD}"= TCP:C:\Program Files\Cyanide\Pro Cycling Manager - Season 2008\PCM.exe:Pro Cycling Manager - Season 2008

"{6F456F5F-F3B3-49BF-83C8-F6FF52B0BC22}"= UDP:C:\Program Files\Cyanide\Pro Cycling Manager - Season 2008\Autorun\Exe\Autorun.exe:Pro Cycling Manager - Season 2008 - AutoRun

"{F31CFFB7-3D4E-4FCF-85B0-F9BC6DFD168D}"= TCP:C:\Program Files\Cyanide\Pro Cycling Manager - Season 2008\Autorun\Exe\Autorun.exe:Pro Cycling Manager - Season 2008 - AutoRun

"{4FF2E2E2-A5E2-47DD-A758-1CA5532C9B2C}"= UDP:C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger

"{C3CFCC17-3420-4A72-8107-0C06F104192B}"= TCP:C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger

"{B95F92B5-C133-4C83-9987-A278502ECEB9}"= UDP:C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger

"{FCA561F1-A109-4760-A7D8-03FDD3EB2074}"= TCP:C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger

"{34123567-46A2-478A-9D15-4896CFFAE756}"= UDP:C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger

"{A08F6E51-977C-4328-BE57-92C2C3011F4A}"= TCP:C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger

"TCP Query User{B3CBD5BD-CF82-45D2-B107-B35C68C30315}C:\\program files\\sopcast\\adv\\sopadver.exe"= UDP:C:\program files\sopcast\adv\sopadver.exe:SopCast Adver

"UDP Query User{9C31BBA2-E328-4390-BB94-50F35B656F6F}C:\\program files\\sopcast\\adv\\sopadver.exe"= TCP:C:\program files\sopcast\adv\sopadver.exe:SopCast Adver

"TCP Query User{A1FC7604-C7F7-4A8A-B944-6BEEFD282C8D}C:\\program files\\sopcast\\sopcast.exe"= UDP:C:\program files\sopcast\sopcast.exe:SopCast Main Application

"UDP Query User{98DD25E4-2E71-4FFA-A4F7-BB38E0B5C998}C:\\program files\\sopcast\\sopcast.exe"= TCP:C:\program files\sopcast\sopcast.exe:SopCast Main Application

"TCP Query User{4F8F5CD5-4CF0-447D-921F-44B2382F26F6}C:\\program files\\tvants\\tvants.exe"= UDP:C:\program files\tvants\tvants.exe:TVAnts

"UDP Query User{7296E19E-1A3B-450B-9635-DF8D998A73D3}C:\\program files\\tvants\\tvants.exe"= TCP:C:\program files\tvants\tvants.exe:TVAnts

"TCP Query User{E2D4397E-250F-4F0A-BED2-1A141AFA79FB}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer

"UDP Query User{F93BDC11-9B39-4CD0-85CE-480ECFFE7A57}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer

"{CE31D885-1C5B-400C-BD7D-594740B96DD0}"= C:\Program Files\AVG\AVG8\avgupd.exe:avgupd.exe

"{4B9C5C2D-82C8-471E-9F0D-314913A079DB}"= C:\Program Files\AVG\AVG8\avgnsx.exe:avgnsx.exe

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]

"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

 

R0 AvgRkx86;avgrkx86.sys;C:\Windows\system32\Drivers\avgrkx86.sys [2008-08-13 12936]

R0 iaNvStor;Intel® Turbo Memory Technology NAND Controller;C:\Windows\system32\DRIVERS\iaNvStor.sys [2007-05-04 208896]

R1 appdrv01;Application Driver (01);C:\Windows\system32\Drivers\appdrv01.sys [2008-07-23 3468904]

R1 AvgLdx86;AVG AVI Loader Driver x86;C:\Windows\system32\Drivers\avgldx86.sys [2008-08-13 97928]

R1 fanio;FanIO driver;C:\Windows\system32\drivers\fanio.sys [2007-02-16 14464]

R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-08-13 231704]

R2 BthFilterHelper;Bluetooth Feature Support;C:\Program Files\CSR\Vista Profile Pack\BthFilterHelper.exe [2006-11-07 127488]

R3 AvgWfpX;AVG8 Firewall Driver x86;C:\Windows\system32\Drivers\avgwfpx.sys [2008-08-13 69128]

S0 OemBiosDevice;Royalty OEM BIOS Extension;C:\Windows\system32\DRIVERS\royal.sys [2007-05-26 240128]

S2 appdrvrem01;Application Driver Auto Removal Service (01);C:\Windows\System32\appdrvrem01.exe svc [ ]

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\b57nd60x.sys [2007-02-08 179712]

S3 cmeu0wdm;CardMan 2020;C:\Windows\system32\DRIVERS\cmeu0wdm.sys [2005-05-23 43737]

S3 DellBIOS;DellBIOS;C:\Windows\DellBIOS.Sys [2008-08-13 7168]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

bthsvcs REG_MULTI_SZ BthServ

WindowsMobile REG_MULTI_SZ wcescomm rapimgr

LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]

\shell\AutoRun\command - E:\AllwaySync'n'Go.exe -autorun

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]

\shell\AutoRun\command - G:\AllwaySync'n'Go.exe -autorun

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6e4b7af7-9797-11dc-bf20-b322a69a4400}]

\shell\AutoRun\command - F:\autorun.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{74fa5581-5758-11dd-8960-8b2c35172df0}]

\shell\AutoRun\command - E:\Launcher.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9c8cbfea-7d01-11dc-ac06-001a6bc4f626}]

\shell\AutoRun\command - G:\AllwaySync'n'Go.exe -autorun

 

*Newly Created Service* - CATCHME

*Newly Created Service* - GMER

*Newly Created Service* - PROCEXP90

*Newly Created Service* - SASDIFSV

*Newly Created Service* - SASENUM

*Newly Created Service* - SASKUTIL

.

Contents of the 'Scheduled Tasks' folder

.

.

------- Supplementary Scan -------

.

FireFox -: Profile - C:\Users\fredes\AppData\Roaming\Mozilla\Firefox\Profiles\tkw4xg0m.default\

FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://go.microsoft.com/fwlink/?LinkId=69157

FireFox -: user.js - STARTUP.HOMEPAGE - hxxp://go.microsoft.com/fwlink/?LinkId=69157

FF -: plugin - c:\Program Files\Microsoft Silverlight\2.0.30226.2\npctrl.dll

FF -: plugin - c:\Program Files\Microsoft Silverlight\2.0.30523.8\npctrl.1.0.30109.0.dll

FF -: plugin - c:\Program Files\Microsoft Silverlight\2.0.30523.8\npctrl.dll

FF -: plugin - C:\Users\fredes\AppData\Local\Google\Update\1.2.131.11\npGoogleOneClick5.dll

.

 

**************************************************************************

 

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-09-03 20:56:34

Windows 6.0.6000 NTFS

 

scanning hidden processes ...

 

scanning hidden autostart entries ...

 

scanning hidden files ...

 

scan completed successfully

hidden files: 0

 

**************************************************************************

.

Completion time: 2008-09-03 20:57:45

ComboFix-quarantined-files.txt 2008-09-03 18:57:42

 

Pre-Run: 52,436,328,448 bytes free

Post-Run: 52,398,436,352 bytes free

 

267 --- E O F --- 2008-09-02 23:43:57

 

Hijackthis:

Klikk for å se/fjerne innholdet nedenfor

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 20:59:50, on 03.09.2008

Platform: Windows Vista (WinNT 6.00.1904)

MSIE: Internet Explorer v7.00 (7.00.6000.16711)

Boot mode: Normal

 

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\Apoint\Apoint.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Windows\WindowsMobile\wmdSync.exe

C:\Program Files\AVG\AVG8\avgtray.exe

C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe

C:\Program Files\Apoint\ApMsgFwd.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Apoint\Apntex.exe

C:\Program Files\Apoint\HidFind.exe

C:\Program Files\I8kfanGUI\I8kfanGUI.exe

C:\Program Files\SharpSoft\Vista Battery Saver\VistaBatterySaver.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

C:\Program Files\Logitech\SetPoint\SetPoint.exe

C:\Program Files\Dell\QuickSet\quickset.exe

C:\Windows\System32\rundll32.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE

C:\Users\fredes\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\fredes\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\fredes\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\fredes\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\fredes\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Windows\system32\conime.exe

C:\Windows\Explorer.exe

C:\Users\fredes\Desktop\drops.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemonsearch.com/no/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: ::1 localhost

O2 - BHO: Koblingshjelpeprogram for Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe

O4 - HKLM\..\Run: [iAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe

O4 - HKLM\..\Run: [iaNvSrv] C:\Program Files\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [sigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe

O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [NVHotkey] rundll32.exe C:\Windows\system32\nvHotkey.dll,Start

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [i8kfangui] C:\Program Files\I8kfanGUI\I8kfanGUI.exe /startup

O4 - HKCU\..\Run: [VistaBatterySaver] C:\Program Files\SharpSoft\Vista Battery Saver\VistaBatterySaver.exe

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [Google Update] "C:\Users\fredes\AppData\Local\Google\Update\GoogleUpdate.exe" /c

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')

O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe

O4 - Global Startup: QuickSet.lnk = C:\Program Files\Dell\QuickSet\quickset.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O13 - Gopher Prefix:

O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

O20 - AppInit_DLLs: avgrsstx.dll

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll

O23 - Service: Application Driver Auto Removal Service (01) (appdrvrem01) - Protection Technology - C:\Windows\System32\appdrvrem01.exe

O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: Bluetooth Feature Support (BthFilterHelper) - CSR, plc - C:\Program Files\CSR\Vista Profile Pack\BthFilterHelper.exe

O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe

O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTServ.exe

O23 - Service: Dell Internal Network Card Power Management (nicconfigsvc) - Dell Inc. - C:\Program Files\Dell\QuickSet\NicConfigSvc.exe

O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe

 

--

End of file - 8432 bytes

 

SAS:

Klikk for å se/fjerne innholdet nedenfor

SUPERAntiSpyware Scan Log

http://www.superantispyware.com

 

Generated 09/03/2008 at 08:52 PM

 

Application Version : 4.20.1046

 

Core Rules Database Version : 3556

Trace Rules Database Version: 1544

 

Scan type : Quick Scan

Total Scan Time : 00:16:00

 

Memory items scanned : 587

Memory threats detected : 0

Registry items scanned : 480

Registry threats detected : 0

File items scanned : 17550

File threats detected : 0

[norbat]

Ser fint ut dette. Var det bare en sjekk eller er det noe som skulle tilsi at du er infisert med noe?

[fredes]

Glemte å slenge med resultatet av AVG Anti-rootkit, som forteller at følgende er funnet:

 

Hidden driver

C:\Windows\System32\Drivers\adhdt2i8.SYS

 

Det popper forøvrig opp etter 1 sekund med scanning.

Endret 3. september 2008 av fredes

[norbat]

Når du sier AVG Anti-rootkit, så mener du AVG8 (der rootkit-programmer er integrert)?

 

Loggene du har postet tilsier at du ikke har noen rootkit liggende (combofix kjører også en rootkitsjekk - gmer).

Er det slik at AVG sier at det er en rootkit eller får du noen annen info om fila?

[fredes]

Stemmer at det er AVG8s integrerte rootkitscanner.

 

Får ingen info om fila, annet enn at det er en "Hidden driver".

 

I tillegg står det

 

Rootkits count : 0/1

 

Hvis jeg ber AVG om å fjerne infeksjonen dukker det bare opp ei ny, lignende, fil etter reboot.

Nå er det for eksempel ap09lm78.SYS som gjelder

Endret 3. september 2008 av fredes

[norbat]

Slike filer kan like godt være knyttet til et av sikkerhetsprogrammene du bruker inkl. brannmur. Du kunne ha kjørt en scan med Blacklight (rootkitskanner) og sett om den finner noe tilsvarende.

[fredes]

Blacklight fant ingenting.

 

Satser på at det ikke er noe å bekymre seg over.

Takk for hjelpen